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PREFACE 


The  events  of  September  11,  2001  graphieally  illustrated  the  dangers  the  United 
States  faees  from  terrorism.  Unfortunately,  the  men  and  women  who  died  at  the 
Pentagon  were  not  the  first  Department  of  Defense  personnel  to  be  killed  by  terrorists. 
The  bombings  of  the  Marine  Barracks  in  Beirut,  Khobar  Towers  in  Saudi  Arabia,  and  the 
USS  Cole  in  Yemen  illustrate  the  dangers  faced  by  DoD  personnel  throughout  the  world. 
The  ability  to  collect  and  analyze  force  protection  intelligence  is  crucial  to  the  Air 
Force’s  ability  to  protect  military  personnel,  civilian  employees,  and  their  family 
members.  This  paper  explores  current  Air  Force  Intelligence  and  counterintelligence  (Cl) 
support  to  force  protection,  and  offers  suggestions  to  improve  this  support. 

1  would  like  to  thank  LtCol  Richard  Holbrook,  Headquarters  Air  Force  Office  of 
Special  Investigations  (AFOSI)  Cl  Analysis  and  Production,  LtCol  Phil  Osborne,  US 
Central  Command  Air  Forces  (USCENTAF)  A-2,  Major  John  West,  USCENTAF  Eorce 
Protection,  Randall  Tate,  AEOSI  Region  2  Threat  Analysis  Cell,  and  Special  Agent 
Steven  Roehrick,  USCENTAE  AEOSI.  Discussions  with  these  gentlemen  helped  form 
the  topics  and  arguments  presented  in  this  paper.  I  would  also  like  to  thank  EtCol  Matt 
Durham,  Air  Command  and  Staff  College,  for  his  suggestions  and  insights.  Einally,  I 
would  like  to  thank  my  faculty  advisor.  Major  Anthony  Ring  for  his  assistance  and 
support. 
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Abstract 

The  Air  Force  has  devoted  significant  energy,  effort  and  financial  resources  to 
improve  its  force  protection  efforts  since  the  June  1996  Khobar  Towers  attack.  Despite 
these  efforts,  there  remains  room  for  additional  improvement.  The  most  visible  aspect  of 
force  protection  is  physical  security,  and  this  area  has  received  the  most  attention  in  Air 
Force  force  protection  efforts.  Physical  security  is  important,  but  it  does  not  override  the 
role  of  force  protection  intelligence.  In  order  to  improve  the  effectiveness  and  efficiency 
of  our  force  protection  efforts,  we  must  be  able  to  collect  and  analyze  information  on 
potential  terrorists,  saboteurs  or  other  force  protection  threats  in  any  location  where  Air 
Force  resources  and  personnel  operate. 

In  this  paper,  I  examine  the  role  of  intelligence  and  counterintelligence  (Cl)  in  force 
protection,  and  provide  suggestions  for  improving  the  Air  Force’s  ability  to  detect, 
analyze,  and  investigate  force  protection  threats.  I  first  suggest  the  Air  Force  must  clarify 
the  roles  of  Air  Force  Intelligence  and  Cl  in  force  protection,  and  produce  comprehensive 
Cl  doctrine.  Secondly,  I  discuss  the  need  to  increase  the  presence  of  Air  Force  Cl 
personnel  in  major  US  cities  and  key  foreign  areas.  I  also  offer  proposals  to  increase  the 
number  of  Air  Force  personnel  engaged  in  Cl  collection  activities.  Finally,  I  discuss  the 
need  for  the  Air  Force  to  clearly  assign  responsibility  for  the  analysis  of  force  protection 
intelligence,  and  develop  force  protection  analytical  cells  at  the  Headquarters  Air  Force, 
major  command,  and  numbered  Air  Force  levels. 
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Chapter  1 


Introduction 

The  Air  Force  has  made  significant  efforts  to  improve  its  force  protection 
capabilities  since  the  Khobar  Towers  attack  in  June  1996,  but  terrorism  and  other  threats 
continue  to  pose  substantial  dangers.  The  Air  Force  can  further  enhance  its  antiterrorism 
program  by  improving  intelligence  and  counterintelligence  (Cl)  support  to  force 
protection.  This  paper  examines  current  force  protection  intelligence  and  Cl  efforts,  and 
proposes  specific  measures  to  improve  the  collection  and  analysis  of  force  protection 
intelligence. 

It  begins  by  exploring  the  role  of  intelligence  and  Cl  in  force  protection,  and 
discusses  the  current  Air  Force  Intelligence  and  Cl  structure.  The  paper  also  examines 
previous  anti-DoD  terrorist  attacks  to  determine  if  they  provide  lessons  learned  for  the 
Air  Force.  Next,  it  reviews  current  Air  Force  intelligence  and  Cl  doctrine,  and  proposes 
measures  to  improve  the  Air  Force’s  ability  to  collect  force  protection  intelligence  and 
investigate  force  protection  threats.  Finally,  the  paper  discusses  how  the  Air  Force  can 
improve  its  ability  to  conduct  all-source  analysis  of  force  protection  intelligence. 
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Chapter  2 


Background 


Some  Air  Force  personnel  erroneously  believe  that  force  protection  is  a  physical 
security  program  managed  by  Security  Forces  (SF)  personnel.  Although  physical 
security  plays  a  highly  visible  role  in  force  protection,  it  is  only  one  part  of  the  overall 
effort.  Air  Force  force  protection  doctrine  recognizes  force  protection  efforts  must  be 
threat  driven.  This  doctrine  requires  commanders  to  identify  force  protection  threats,  and 
determine  vulnerabilities  before  implementing  protective  measures.'  Air  Force 
Intelligence  and  Cl  personnel  play  a  key  role  in  helping  commanders  identify  threats  and 
assess  vulnerabilities. 

The  Role  of  Intelligence  and  Counterintelligence  in  Force  Protection 

The  collection  and  analysis  of  intelligence  on  the  capabilities,  intentions,  strategy, 
and  tactics  employed  by  terrorists  or  saboteurs  improves  force  protection  efforts  by 
enabling  commanders  to  tailor  offensive  and  defensive  measures  to  the  specific  threat. 
Protecting  critical  information  regarding  defense  plans,  the  layout  of  US  installations, 
specific  security  measures,  and  the  strengths  and  weaknesses  of  security  forces  can  also 

enhance  security.  These  activities  make  it  more  difficult  for  potential  adversaries  to 
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collect  information  needed  to  develop  terrorist  or  sabotage  operations. 
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To  understand  the  distinet  roles  of  intelligence  and  Cl  in  force  protection,  you  must 

first  understand  the  difference  between  these  disciplines.  DoD  Directive  5240.1,  DoD 

Intelligence  Activities,  states  DoD  intelligence  agencies  collect,  produce  and  disseminate 

both  foreign  intelligence  and  CL  This  directive  provides  the  following  definitions: 

Foreign  intelligence.  Information  relating  to  the  capabilities,  intentions, 
and  activities  of  foreign  powers,  organizations,  or  persons,  but  not 
including  counterintelligence  except  for  information  on  international 
terrorist  activities. 

Counterintelligence.  Information  gathered  and  activities  conducted  to 
protect  against  espionage,  other  intelligence  activities,  sabotage,  or 
assassinations  conducted  for  or  on  behalf  of  foreign  powers,  organizations, 
or  persons,  or  international  terrorist  activities,  but  not  including  personnel, 
physical,  document,  or  communications  security  programs.^ 

These  definitions  show  that  both  foreign  intelligence  and  Cl  play  a  role  in  countering 
terrorist  threats.  Several  US  intelligence  agencies,  including  the  Central  Intelligence 
Agency  (CIA)  and  the  National  Security  Agency  (NSA),  collect  and  analyze  both  foreign 
intelligence  and  Cl  information."^  For  these  agencies,  the  overlapping  roles  foreign 
intelligence  and  Cl  play  in  identifying  and  countering  terrorist  threats  cause  no  confusion 
or  consternation.  The  Air  Force  Intelligence  structure  lacks  this  simplicity. 

Air  Force  Intelligence  and  Counterintelligence  Structure 

Within  the  Air  Force,  responsibility  for  foreign  intelligence  and  Cl  rests  within 
different  organizations  with  different  structures,  philosophies,  traditions,  and  chains-of- 
command.  Air  Force  Intelligence  performs  the  foreign  intelligence  mission,  while  the 
Air  Force  Office  of  Special  Investigations  (AFOSI)  performs  the  Cl  mission.  This 
division  of  responsibility  has  caused  confusion  both  within  and  outside  the  Air  Force. 
Cooperation  between  Air  Force  Intelligence  and  AFOSI  is  heavily  dependent  on  personal 
relationships.  When  these  agencies  fail  to  coordinate.  Air  Force  leaders  receive 
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duplicative  or  even  eonflicting  information  on  terrorist  and  other  force  proteetion  threats. 
Combatant  eommand  J-2s,  especially  those  from  the  US  Army  or  Marine  Corps, 
routinely  task  the  Air  Force  eomponent  A-2  to  complete  Cl  annexes  of  operation  plans  or 
eonduct  Cl  analysis.^ 

The  Air  Force  Office  of  Special  Investigations  is  a  federal  law  enforcement  agency, 
and  a  component  of  the  DoD  Intelligence  Community.^  In  addition  to  performing  Air 
Force  Cl  activities,  AFOSI  also  performs  criminal  investigations.  The  command 
investigates  major  criminal  offenses  including  violent  erime,  eeonomic  erime,  and 
narcotie  violations.^  Its  dual  role  as  both  an  intelligenee  and  law  enforeement  agency 
provides  AFOSI  powerful  authorities  to  counter  both  international  and  domestic  threats. 

AFI  31-210,  The  Air  Force  Antiterrorism/Force  Protection  (AT/FP)  Program 

Standards,  recognizes  the  need  for  both  Air  Foree  Intelligence  and  AFOSI  to  partieipate 

in  foree  proteetion  efforts,  and  assigns  these  organizations  the  following  responsibilities: 

Headquarters  AFOSI  has  primary  responsibility  for  eollection,  analysis, 
dissemination  and  production  of  terrorist  threat  information  gathered  from 
loeal  authorities  and  counterintelligenee  sourees. 

Headquarters  Air  Force  Directorate  of  Intelligence,  Surveillance  and 
Reconnaissance  (Air  Force/XOI)  is  responsible  for  ensuring  the  timely 
collection,  processing,  analysis,  production  and  dissemination  of  foreign 
intelligence,  current  intelligenee,  and  national-level  intelligenee 
information  concerning  terrorist  activities,  terrorist  organizations  and  force 
proteetion  issues.  These  efforts  will  focus  on,  but  will  not  be  limited  to, 
transnational  and  state-sponsored  entities  and  organizations.^ 

By  assigning  similar  responsibilities  for  collection,  analysis  and  dissemination  of  threat 

information  to  Air  Force  Intelligenee  and  AFOSI,  AFI  31-210  has  added  to  the  confusion 

regarding  the  foree  protection  responsibilities  of  these  agencies. 

In  June  2001,  Air  Foree  Intelligenee,  Surveillance  and  Reeonnaissance  (HQ  Air 
ForeeVXOI)  produced  a  Draft  Air  Force  Instruction  (AFI)  entitled.  Intelligence  Support 
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To  Anti-Terrorism/Force  Protection.  This  draft  API  would  assign  Air  Force  Intelligence 
the  responsibility  to  serve  as  the  primary  interfaee  with  the  Department  of  Defense 
intelligence  collection  community  for  Air  Force  foree  protection  intelligence  produetion 
requirements.  It  would  also  task  Air  Force  Intelligenee  to  exchange  intelligence  with  US 
embassies  and  country  teams,  work  with  Department  of  State  Regional  Seeurity  Officers, 
evaluate  intelligence  reporting,  and  guide  collection  efforts.^  The  Air  Force  Office  of 
Special  Investigations  has  historically  performed  these  tasks  for  the  Air  Force.  If 
published  in  its  current  form,  this  draft  instruction  would  cause  additional  overlap, 
confusion,  and  inefficiency  between  Air  Foree  Intelligenee  and  AFOSI. 

Force  Protection  Threats 

Air  Force  foree  protection  doctrine  requires  intelligence  and  Cl  personnel  to 
obtain  and  analyze  information  on; 

conventional  military  units,  speeial  forces,  terrorist  groups,  riotous  eivil 
populations,  environmental  and  health  hazards,  ehemical  or  biological 
agents,  radioactive  material,  cyberterrorists,  eriminal  elements,  religious 
zealots,  extremist  groups,  and  the  weapons  any  of  these  groups  might 
select. 

DoD  Directive  2000.12,  DoD  Antiterrorism/Force  Protection  (AT/FP)  Program,  requires 
the  Seeretaries  of  the  military  services  to  “ensure  that  Service  eomponent  eapabilities 
exist  to  collect,  receive,  evaluate,  analyze,  and  disseminate  all  relevant  data  on  terrorist 

activities,  trends,  and  indicators  of  imminent  attack.”''  The  Secretary  of  the  Air  Force 
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has  tasked  AFOSI  to  perform  this  mission  for  the  Air  Foree. 

Intelligence  agencies  use  a  variety  of  sourees  to  collect  foreign  intelligence  and 
Cl.  These  collection  sources  are  grouped  in  various  intelligence  disciplines  including 
human  intelligence  (HUMINT),  imagery  intelligence  (IMINT),  open-souree  intelligence 
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(OSINT),  and  signals  intelligence  (SIGINT).  Although  all  intelligence  disciplines  can 
be  used  to  gather  force  protection  intelligence,  HUMINT  collected  by  intelligence  and  Cl 
agencies  plays  a  key  role  in  providing  indications  and  warning  of  terrorist  and  other  force 
protection  threats. 

Air  Force  doctrine  divides  force  protection  threats  into  four  categories:  Basic, 
Level  I,  Level  II,  and  Level  III.  Basic  threats  include  criminal  activity,  riots,  and  disease 
while  Level  I  threats  include  sabotage  and  terrorist  attacks.  Level  II  threats  include 
reconnaissance,  and  sabotage  operations  conducted  by  special-purpose,  guerrilla,  and 
unconventional  forces.  Finally,  Level  III  threats  include  major  land  or  air  attacks 
including  air  and  missile  attacks,  airborne  operations,  and  amphibious  ahacks.'"^ 

Air  Force  HUMINT  Capabilities 

In  1993,  the  Deputy  Secretary  of  Defense  ordered  the  consolidation  of  service 
General  Defense  Intelligence  Program  (GDIP)  funded  HUMINT  activities  into  the 
Defense  HUMINT  Service  (DHS).^^  Following  this  consolidation,  “the  Services  were 
only  authorized  to  maintain  carefully  focused,  overt,  non-sensitive  HUMINT  activities  to 
support  service-unique  requirements.”  These  service-unique  requirements  included 
Tactical  Intelligence  and  Related  Activities  (TIARA)  funded  collection  programs 
designed  to  provide  tactical,  time-sensitive  intelligence  to  operational  commanders.  At 
the  time  of  this  consolidation,  the  Air  Force  possessed  no  TIARA  funded  HUMINT 
functions.  When  the  Khobar  Towers  attack  occurred  in  1996,  AFOSI’s  Cl  collections 
capability  was  the  only  organic  HUMINT  function  possessed  by  the  Air  Force. 

DoD  Directive  5240.2,  DoD  Counterintelligence,  defines  Cl  collection  as,  “The 
systematic  acquisition  of  information  concerning  espionage,  sabotage,  terrorism,  and 
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related  foreign  aetivities  condueted  for  or  on  behalf  of  foreign  nations,  entities, 

organizations,  or  persons  and  that  are  direeted  against  or  threaten  DoD  interests.”  Cl 

personnel  use  a  variety  of  HUMINT  sources  to  collect  force  protection  information 

including  casual  sources,  official  sources  or  liaison  contacts,  and  recruited  sources. The 

Cl  collections  and  investigative  functions  performed  by  AFOSI  make  it  uniquely  suited 

to  use  human  sources  to  gather  information  on  Basic,  Level  I,  and  Level  II  threats. 

AFOSI  also  conducts  all-source  analysis  to  fuse  this  data  with  HUMINT,  IMINT,  OSINT 

and  SIGINT  obtained  from  national-level  intelligence  agencies.  Air  Force  intelligence 

primarily  focuses  on  gathering  and  analyzing  information  on  Level  III  threats  obtained 

20 

from  Air  Force  and  national-level  technical  collection  platforms. 

Learning  From  the  Past 

US  military  personnel  have  faced  the  threat  of  terrorism  for  several  decades,  and 
examining  previous  attacks  can  provide  valuable  insight  into  the  problem.  The  attack 
against  the  US  Marine  Barracks  in  Beirut  Lebanon  serves  as  a  useful  starting  point  for 
examining  anti-DoD  terrorism. 

The  Bombing  of  the  US  Marine  Barracks 

A  vehicle  packed  with  the  equivalent  of  12,000  pounds  of  TNT  penetrated  the 
security  perimeter  of  the  US  Marine  contingent  at  the  Beirut  International  Airport  on 
October  23,  1983,  crashed  into  the  Battalion  Landing  Team  Headquarters  Building,  and 
exploded.  The  explosion  destroyed  the  building  and  killed  241  Marines.  Following 
this  tragedy,  the  Secretary  of  Defense  established  a  five-member  commission  led  by 
Admiral  Robert  Long  to  conduct  an  independent  inquiry  of  the  facts  and  circumstances 
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surrounding  this  attack.  Among  other  deficiencies,  the  report  prepared  by  the  Long 
Commission  faulted  US  intelligence  collection,  analysis,  and  investigative  efforts. 

The  Long  Commission  faulted  US  intelligence  collection  efforts  undertaken  to 
support  Marine  forces  in  Beirut,  and  was  especially  critical  of  the  lack  of  HUMINT 
support.  The  commission  found  HUMINT  support  was  ineffective,  imprecise,  and  not 
tailored  to  the  needs  of  the  commander.  They  noted,  “Intelligence  sources  were  unable 
to  provide  proven,  accurate,  definitive  information  on  terrorist  tactics  against  our  forces”, 
and  commented  that  commanders  were  not  provided  “specific  information  on  how,  where 
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and  when”  a  terrorist  attack  would  be  carried  out. 

In  addition  to  detailing  weaknesses  in  US  intelligence  collection  efforts,  the 
commission  also  noted  Marine  forces  in  Beirut  lacked  the  capability  to  conduct  tactical 
analysis  or  investigate  threats.  The  Long  Commission’s  report  stated,  “Seldom  did  the 
US  have  a  mechanism  at  its  disposal  which  would  allow  a  follow  up  on  [these]  leads  and 
a  further  refinement  of  the  information  into  intelligence  which  served  for  other  than 
warning. In  conclusion,  the  Commission  determined  that  although  the  Marine  Corps 
commander  received  numerous  terrorist  threat  warnings  before  October  23,  1983,  he  was 
not  provided  the  intelligence  he  needed  to  counter  this  attack.  The  Beirut  attack  clearly 
showed  that  terrorism  posed  a  significant  threat  to  US  military  personnel.  The  inability 
to  detect  and  neutralize  this  attack  pointedly  demonstrated  that  US  force  protection 
intelligence  collection  and  analysis  efforts  were  ineffective. 

Khobar  Towers 

On  June  25,  1996  a  truck  bomb  exploded  outside  the  perimeter  of  Khobar  Towers, 
Dhahran,  Saudi  Arabia.  The  explosion  destroyed  a  building  used  to  house  US  military 
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personnel,  and  resulted  in  the  deaths  of  19  Air  Foree  members.  Following  this  attack, 
numerous  Air  Force,  DoD,  and  congressional  inquiries  were  conducted.  General  Wayne 
A.  Downing  led  the  primary  DoD  inquiry.  Several  of  the  Downing  Commission’s 
findings  and  recommendations  regarding  intelligence  and  Cl  support  provided  to  US 
forces  remain  classified.  Despite  this,  a  review  of  the  unclassified  version  of  the 
Commission’s  report  still  provides  valuable  insights. 

The  Downing  Commission  noted  weaknesses  in  both  the  collection  and  analysis  of 
force  protection  intelligence.  Commission  members  found  that  DoD  elements  failed  to 
exercise  all  their  intelligence  collection  authorities,  and  exploit  “all  potential  sources  of 
information”.  The  Commission’s  report  stressed  the  role  of  HUMINT  in  force 
protection  efforts,  and  stated  “precise  warning  of  terrorist  attacks  depends  on  HUMINT 
to  identify  specific  targets  and  the  time  and  nature  of  the  attack.”  The  report  also  stated 
the  US  must  make  larger  investments  in  terms  of  time,  effort,  and  resources  in  order  to 

30 

develop  HUMINT  sources  of  information. 

The  Commission  also  found  weaknesses  in  intelligence  analysis  at  the  national, 
theater,  and  tactical  levels.  It  noted  the  military  intelligence  community  lacked  the  ability 
to  conduct  “in-depth,  long-term  analysis  of  trends,  intentions,  and  capabilities  of 
terrorists.”^'  At  the  tactical  level,  the  Commission  concluded  “the  4404'*^  Wing 
Commander  was  ill-served  by  the  intelligence  arrangement  within  his  command  which 
focused  almost  exclusively  on  the  air  threat  for  Operation  SOUTHERN  WATCH. The 
report  further  noted  that  the  4404"'  Wing  Commander  “did  not  have  a  dedicated,  organic, 

33 

and  focused  [force  protection]  intelligence  analytical  capability.” 


9 


The  USS  Cole 


Terrorists  attacked  the  USS  Cole  on  October  12,  2000  while  the  ship  refueled  in  the 

port  of  Aden,  Yemen.  This  attack  highlighted  the  vulnerability  of  in-transit  forces,  and 

the  need  for  DoD  to  allocate  additional  resources  to  support  force  protection  intelligence 

efforts.  This  report  also  stressed  the  role  of  Service  Component  Commanders  in  force 

protection.^"^  The  DoD  commission  chartered  to  examine  this  attack  found  that  “DoD 

does  not  allocate  sufficient  resources  or  all-source  intelligence  analysis  and  collection  in 

support  of  combating  terrorism.”  Based  on  this  finding,  the  commission  recommended 

that  the  Secretary  of  Defense  reprioritize: 

all-source  intelligence  collection  and  analysis  personnel  and  resources  so 
that  sufficient  emphasis  is  applied  to  combating  terrorism.  Analytical 
expertise  must  be  imbedded,  from  the  national,  CINC,  and  Component 
Command  levels,  to  the  joint  task  force  level. 

terrorism-related  human  intelligence  and  signals  intelligence  resources. 

resources  for  the  development  of  language  skills  that  support  combating 
terrorism  analysis  and  collection.^^ 

The  commission  also  noted  the  importance  of  service  Cl  programs  in  force  protection 
efforts  and  recommended  that  the  SECDEF  ensure  DoD  Cl  organizations  are  adequately 
staffed  and  funded  to  meet  force  protection  requirements. 

Analyzing  the  Lessons  Learned  from  Previous  Attacks 

The  attacks  on  the  Marine  Barracks,  Khobar  Towers,  and  the  USS  Cole  offer 
remarkably  similar  lessons.  The  commissions  chartered  to  examine  these  attacks  stressed 
the  need  to  improve  the  intelligence  community’s  ability  to  collect  force  protection 
intelligence,  and  stressed  the  role  of  HUMINT  in  identifying  terrorist  threats.  They  also 
documented  the  need  to  improve  all-source  analysis  of  terrorism  information. 
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Although  these  commissions  reviewed  the  activities  of  US  national  intelligence 
organizations,  they  also  stressed  the  need  for  military  units  operating  in  high-threat 
environments  to  possess  organic  intelligence  collection,  analysis,  and  investigative 
capabilities.  The  Cole  Commission  stressed  the  role  of  Service  Component  Commanders 
in  force  protection  efforts.  The  Air  Force  has  little  control  over  the  actions  of  national 
intelligence  organizations,  but  can  control  how  it  organizes,  trains,  and  equips  the  forces 
provided  to  the  Combatant  Commands. 
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Chapter  3 


Improving  the  Air  Force’s  Ability  to  Collect  Force  Protection 
Intelligence  and  Investigate  Threats 


Although  all  forms  of  intelligence  can  enhance  force  protection,  HUMINT  plays  a 
critical  role  in  providing  tactical  warning  of  terrorist  plans.  As  previously  discussed, 
AFOSI  Cl  collectors  are  the  primary  HUMINT  assets  managed  by  the  Air  Force.  The 
Air  Force  can  improve  its  ability  to  collect  force  protection  intelligence  and  investigate 
threats  by  developing  clear  Cl  doctrine,  enhancing  the  presence  of  Cl  collection 
personnel  in  key  foreign  and  US  cities,  and  increasing  the  number  of  Cl  collectors. 

The  Role  of  Doctrine 

Doctrine  guides  the  employment  of  US  military  forces,  and  shapes  how  military 
professionals  “think  about  the  use  of  the  military  instrument  of  national  power”.  ^  The 
four  military  services  develop  service  doctrine  that  supports,  and  is  consistent  with  joint 
doctrine  developed  by  the  Chairman  of  the  Joint  Chiefs  of  Staff  (CJCS)  and  his  staff 
Air  Force  doctrine  provides  commanders  and  their  staffs  a  basic  understanding  of  how 
various  Air  Force  organizations  can  be  used  to  meet  or  support  combat  requirements. 

Air  Force  Counterintelligence  Doctrine 

The  Air  Force  has  historically  lacked  comprehensive  Cl  doctrine.  This  lack  of 
doctrine  has  resulted  in  confusion,  and  hampered  the  ability  of  Air  Force  commanders  to 
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use  Cl  to  improve  foree  proteetion  efforts.  Air  Foree  Doetrine  Doeument  2-5  is  the 
keystone  doeument  addressing  Air  Force  information  operations.  The  Air  Force 
published  the  initial  version  of  AFDD  2-5  in  August  1998.  This  document  included  little 
information  on  Cl,  and  failed  to  address  the  various  Cl  missions  and  their  role  in  force 
protection.  In  fact,  the  majority  of  the  paragraph  on  Cl  discussed  a  US  Navy  espionage 
case.  The  Air  Force  published  an  updated  version  of  AFDD  2-5  in  January  2002.  This 
new  version  included  enhanced  information  on  the  various  Cl  missions,  and  identified 
AFOSI  as  the  organization  chartered  to  conduct  all  Air  Force  related  Cl  collections, 
investigations,  and  operations."^  Although  this  updated  doctrine  is  an  improvement,  there 
remains  room  for  additional  improvement.  The  Air  Force  has  published  several  doctrine 
documents  that  support  AFDD  2-5.  These  documents  include  specific  operational-level 
Air  Force  doctrine  for  electronic  warfare,  intelligence,  surveillance  and  reconnaissance 
operations,  psychological  operations,  and  public  affairs.  There  is  no  current  AFDD  that 
addresses  Cl  activities.^ 

Cl  Doctrine  of  the  Other  Services 

Field  Manual  (FM)  34-1,  Intelligence  and  Electronic  Warfare  Operations,  is  the 
keystone  document  detailing  US  Army  Intelligence  doctrine.  This  document  includes 
significant  information  regarding  Cl  activities,  and  stresses  the  role  of  Cl  in  force 
protection  efforts  during  both  combat  operations  and  military  operations  other  than  war 
(MOOTW).  FM  34-1  states,  “The  essence  of  the  Army’s  Cl  mission  is  to  support  force 
protection,”  and  explains  “Cl  personnel  and  interrogators  provide  HUMINT  to  identify 
and  help  neutralize  enemy  agents,  sympathizers,  and  unconventional  forces  in  the  rear 
area.”*’  FM  34-60,  Counterintelligence,  expounds  on  the  doctrine  presented  in  FM  34-1, 
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and  provides  information  regarding  Cl  taeties,  teehniques  and  procedures.  Field  Manual 
34-60  includes  separate  chapters  on  investigations,  operations,  collections,  and  analysis 
and  production.  Chapter  Four,  “Cl  Collection  Activities”  provides  detailed  information 
on  sources  of  Cl  information.  Cl  force  protection  source  operations  (CFSO),  liaison,  and 
debriefing  activities.^  Although  not  nearly  as  detailed  or  extensive  as  Army  doctrine,  US 
Navy  basic  intelligence  doctrine  also  includes  considerable  discussion  of  Cl  activities. 
Naval  Doctrine  Publication  (NDP)  2,  Naval  Intelligence,  provides  broad  guidance 

o 

for  US  Navy  and  Marine  Corps  Intelligence  activities.  This  document  discusses 

intelligence  support  to  force  protection  and  states: 

force  protection  is  supported  by  all  intelligence  functions,  but  is  executed 
primarily  through  counterintelligence  operations  and  force  security 
measures.  To  neutralize  or  destroy  the  effectiveness  of  hostile  intelligence 
collection  activities,  counterintelligence  and  security  are  essential.  These 
protect  information  against  espionage,  personnel  against  subversion  and 
terrorism,  and  installations  and  material  against  sabotage.  Adversary 
forces  can  be  expected  to  use  every  available  means  to  thwart  or  otherwise 
impede  the  operations  of  our  naval  forces.  Counterintelligence  and 
security  measures  aid  in  identifying  our  own  vulnerabilities  and  reducing 
risks,  and  are  essential  in  achieving  surprise  during  military  operations.^ 

Naval  Doctrine  Publication  2  also  recognizes  the  importance  of  organic  tactical  Cl  and 

HUMINT  in  MOOTW  operations.'*’  Marine  Corps  Intelligence  doctrine  builds  upon  the 

doctrine  presented  in  NDP  2. 

Marine  Corps  Doctrinal  Publication  (MCDP)  2,  Intelligence,  discusses  both 
intelligence  and  CL  Marine  Corps  Doctrinal  Publication  2  states  that  intelligence  has  two 
objectives: 

First,  it  provides  accurate,  timely,  and  relevant  knowledge  about  the 
enemy  (or  potential  enemy)  and  the  surrounding  environment. 

The  second  intelligence  objective  is  that  it  assists  in  protecting  friendly 
forces  through  counterintelligence.  Counterintelligence  includes  both 
active  and  passive  measures  intended  to  deny  the  enemy  valuable 
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information  about  the  friendly  situation.  Counterintelligenee  also  ineludes 
aetivities  related  to  eountering  hostile  espionage,  subversion,  and 
terrorism.  Counterintelligence  directly  supports  force  protection 
operations  by  helping  the  commander  deny  intelligence  to  the  enemy  and 
plan  appropriate  security  measures. 

Marine  Corps  Doctrinal  Publication  2  stresses  the  role  intelligence  plays  in  force 

protection  and  states,  “Intelligence  supports  the  commander’s  force  protection  needs  by 

estimating  an  enemy’s  intelligence,  terrorism,  espionage,  sabotage,  and  subversion 

12 

capabilities  as  well  as  recommending  countermeasures  against  those  capabilities.” 

Marine  Corps  Warfighting  Publication  (MCWP)  2-14,  Counterintelligence,  builds  on 
the  information  presented  in  MCDP  2.  Marine  Corps  Warfighting  Publication  2-14 
discusses  Marine  Corps  Cl  doctrine  and  expounds  on  Cl  tactics,  techniques  and 
procedures.  Marine  Corps  Warfighting  Publication  2-14  includes  detailed  information  on 
the  various  Cl  functions,  and  explains  how  Cl  contributes  to  force  protection.  Marine 
Corps  Warfighting  Publication  2-14  states,  “Cl  provides  critical  intelligence  support  to 
command  force  protection  efforts  by  helping  identify  potential  threats,  threat  capabilities, 
and  planned  intentions  to  friendly  operations  while  helping  deceive  the  adversary  as  to 

1 3 

friendly  capabilities,  vulnerabilities,  and  intentions.” 

Improving  Air  Force  Cl  Doctrine 

The  first  step  in  improving  the  Air  Force’s  ability  to  collect  force  protection 
intelligence  is  building  appropriate  doctrine  that  clarifies  the  role  of  Air  Force 
Intelligence  and  Cl  personnel.  The  Air  Force  should  learn  from  the  Army  and  Marine 
Corps  and  make  its  information  operations  doctrine  more  complete  by  publishing 
comprehensive  Cl  doctrine.  This  doctrine  should  explain  the  primary  Cl  missions  of 
collections,  investigations,  operations,  and  analysis  and  production.  It  should  also 
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describe  the  role  of  Cl  in  force  protection;  clarify  the  relationship  between  Cl  and  Air 
Force  foreign  intelligence  collection  efforts;  and  address  the  logical  connection  between 
Cl  and  criminal  investigations.  Publishing  Air  Force  Cl  doctrine  would  enhance 
understanding  of  Cl  among  Air  Force  leaders,  and  serve  as  a  foundation  to  improve  the 
Air  Force’s  ability  to  organize,  train  and  equip  Cl  forces.  This  is  vitally  important  as  the 
Air  Force  implements  the  Expeditionary  Air  Force  concept  and  its  forces  operate  from 
airfields  in  hostile  environments  during  combat  operations  and  MOOTW  situations. 

AFOSI  units  normally  work  for  a  separate  and  distinct  AFOSI  chain  of  command 
that  ultimately  reports  to  the  Secretary  of  the  Air  Force  (SECAF).  During  contingency  or 
exercise  deployments,  certain  AFOSI  Cl  activities  fall  under  the  operational  control 
(OPCON)  of  the  Combatant  Commander  or  the  Combatant  Commander’s  designated 
Joint  Force  Commander  (JFC).  In  these  situations,  the  SECAF  maintains  control  of 
criminal  and  Cl  investigative  activities  undertaken  by  AFOSI. The  JFC  will  normally 
delegate  OPCON  of  AFOSI  Cl  activities  to  the  Air  Component  Commander  (AFFOR). 

Publishing  Air  Force  level  Cl  doctrine  would  improve  the  ability  of  the  AFFOR  and 
his  staff  to  understand  the  missions  and  capabilities  of  Air  Force  Cl,  and  better  plan  for 
its  proper  use  during  contingency  operations.  Even  when  Air  Eorce  commanders  do  not 
have  OPCON  of  Air  Eorce  Cl  resources,  they  need  a  basic  understanding  of  Cl  doctrine 
so  they  comprehend  the  capabilities  and  limitations  of  their  Cl  support. 

The  Importance  of  Presence 

AEOSI  must  maintain  a  presence  in  friendly  foreign  nations  that  host  Air  Eorce 
personnel,  serve  as  locations  for  major  recurring  exercises,  and  are  regularly  transited  by 
Air  Eorce  aircraft  to  properly  support  Air  Eorce  force  protection  efforts.  AEOSI  must 
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also  maintain  forces  in  major  US  cities  so  they  ean  coordinate  with  federal  law 
enforcement  eounterparts.  AFOSI  currently  maintains  161  units  throughout  the  world. 
The  majority  of  these  units  are  located  at  aetive  Air  Foree  installations  within  the 
continental  US.  AFOSI  also  maintains  45  units  in  18  foreign  countries. 

Improving  Overseas  Collection  Capabilities 

Overseas  AFOSI  units  support  major  Air  Force  installations,  but  there  are  several 
areas  transited  by  Air  Force  aircraft  or  frequently  visited  by  Air  Foree  personnel  on 
exercise  or  contingency  deployments  that  lack  a  permanent  AFOSI  presenee.  The  laek  of 
a  permanent  presence  in  these  areas  hampers  AFOSI’s  ability  to  colleet  information  on 
criminal,  terrorist,  and  foreign  intelligence  threats.  The  Air  Foree  should  learn  from  the 
USS  Cole  attack,  and  improve  its  ability  to  protect  in-transit  forces  by  increasing  the 
presence  of  its  Cl  colleetors  and  investigators  in  important  foreign  areas. 

Air  Force  military  and  civilian  personnel  work  for  military  assistance  units  or 
maintain  war  reserve  material  in  numerous  eountries  throughout  the  world.  Air  Foree 
airlift  aircraft  operating  under  the  auspiees  of  US  Transportation  Command  fly  in  and  out 
of  foreign  military  and  civilian  airfields  every  day  supporting  US  Embassies  and  US 
military  forees.  Many  of  these  loeations  lack  military  Cl  coverage.  Air  Force  units 
deploy  on  a  regular  basis  to  foreign  nations  to  conduct  major  combined  exercises. 
Counterintelligenee  personnel  will  normally  be  part  of  any  deployment,  but  these  agents 
are  forced  to  develop  relationships  with  US  and  foreign  eounterparts  in  a  short  period  of 
time.  They  also  lack  recent  information  on  the  area  in  whieh  they  will  be  working. 

Suceessful  Cl  eollection  programs  are  heavily  dependent  on  liaison  relationships 
with  host  nation  law  enforeement  and  security  services,  and  US  Embassy  personnel. 
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Counterintelligence  collectors  can  not  build  solid  liaison  relationships  overnight,  nor  can 
they  maintain  these  relationships  by  conducting  annual  visits.  Liaison  relationships  are 
an  investment  in  the  future,  and  the  return  on  this  investment  is  directly  proportional  to 
the  time  and  effort  expended  on  developing  and  maintaining  the  relationship.  Foreign 
language  skills  greatly  enhance  an  agent’s  ability  to  conduct  liaison  with  foreign 
counterparts.  Air  Force  Office  of  Special  Investigations  presence  in  foreign  areas  allows 
agents  to  develop  liaison  relationships  with  host  nation  law  enforcement  and  intelligence 
agencies,  develop  an  understanding  of  local  environments,  and  improve  their  foreign 
language  abilities. 

The  Air  Force  Office  of  Special  Investigations  must  continue  efforts  to  place  Cl 
agents  in  US  embassies,  and  co-locate  AFOSI  units  with  military  assistance  and  advisory 
units  in  foreign  countries  to  provide  Cl  support  to  force  protection.  They  should  also 
continue  to  capitalize  on  opportunities  to  create  joint  military  Cl  offices  in  key  foreign 
locations  with  the  Naval  Criminal  Investigative  Service  (NCIS)  and  Army  Military 
Intelligence.  AFOSI  also  needs  to  place  agents  in  key  US  cities  to  enhance  their  ability 
to  monitor  domestic  terrorism  threats. 

Improving  Domestic  Collection  Capabilities 

Air  Force  personnel  and  resources  are  also  vulnerable  to  force  protection  threats  in 
the  US.  Between  1980  and  1999,  military  personnel  and  facilities  were  the  target  of  13 
terrorist  or  attempted  terrorist  attacks  in  the  US.^^  As  the  lead  federal  agency  tasked  to 
investigate  acts  of  terrorism,  the  Federal  Bureau  of  Investigation  (FBI)  is  responsible  for 
collecting,  coordinating,  analyzing,  managing  and  disseminating  intelligence  and 
criminal  information  on  domestic  and  international  terrorist  entities.  To  improve  its 
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ability  to  coordinate  counter  terrorism  efforts,  the  FBI  leads  Joint  Terrorism  Task  Forces 
(JTTF)  composed  of  federal,  state,  and  local  law  enforcement  agencies.  As  of  May  2001, 
there  were  JTTFs  operating  in  16  major  US  cities,  and  the  FBI  had  plans  to  develop 

JTTFs  in  other  locations.'^  AFOSI  Special  Agents  were  members  of  ten  of  these  task 
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forces  as  of  September  2001. 

Although  military  investigators  including  AFOSI  Special  Agents  are  currently 

working  with  FBI  JTTFs,  legal  restrictions  prevent  them  from  full  involvement  in  task 

force  operations.  The  Posse  Comitatus  Act  of  1878  is  widely  viewed  as  prohibiting  any 

use  of  the  Army  or  Air  Force  to  enforce  civilian  law.  This  statute  states: 

Whoever,  except  in  cases  and  under  circumstances  expressly  authorized 
by  the  Constitution  or  Act  of  Congress,  willfully  uses  any  part  of  the 
Army  or  the  Air  Force  as  a  posse  comitatus  or  otherwise  to  execute  the 
laws  shall  be  fined  under  this  title  or  imprisoned  not  more  than  two  years, 
or  both.^^ 

The  lack  of  statutory  arrest  authority  means  that  military  investigators  assigned  to  JTTFs 
can  not  serve,  or  assist  their  civilian  counterparts  in  the  service  of  arrest  warrants.  This 
hampers  their  usefulness  to  task  force  directors,  and  causes  confusion  among  civilian 
counterparts.  The  Air  Force  should  seek  legislation  exempting  military  Special  Agents 
from  the  restrictions  imposed  by  the  Posse  Comitatus  Act,  and  seek  statutory  arrest 
authority  for  these  personnel.  Exempting  these  agents  from  Posse  Comitatus  would 
allow  them  to  be  equal  partners  with  their  civilian  federal,  state  and  local  counterparts, 
and  improve  their  ability  to  collect  force  protection  intelligence  in  the  US. 

AFOSI  should  assign  Special  Agents  to  each  of  the  standing  FBI  Joint  Terrorism 
Task  Forces.  These  task  forces  have  become  the  focal  point  for  law  enforcement  efforts 
to  counter  terrorism  within  the  US.  The  AF  cannot  expect  to  fully  benefit  from  these  task 
forces  and  obtain  relevant  information  from  them  if  they  are  not  full  members  in  their 
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efforts.  AFOSI  should  also  seek  positions  for  its  agents  at  the  Headquarters  FBI  Counter- 
Terrorism  Center. 

Enhancing  the  Number  of  Air  Force  Cl  Collectors 

As  of  April  2000,  AFOSI  had  1,261  full  time  offieer,  non-commissioned  officer  and 
civilian  Special  Agents.  AFOSI  dedicates  approximately  38  percent  of  these  agents  to 
Cl  activities.  Of  these  1,261  agents,  66  are  dedicated  Cl  collectors.  Additional  agents 
perform  Cl  collection  activities,  but  they  do  so  as  a  secondary  responsibility.  Their 
primary  focus  is  other  Cl  activities  or  criminal  investigations.  The  fact  Air  Force 
Intelligence  lacks  significant  HUMINT  collection  capability,  and  only  a  small  percentage 
of  AFOSI  Special  Agents  are  engaged  in  Cl  collection  activities  demonstrates  the  current 
resource  limitations  inherent  in  Air  Force  force  protection  intelligence  collection  efforts. 
The  Air  Force  must  accept  the  fact  that  improving  force  protection  intelligence 
capabilities  will  require  an  additional  investment  in  personnel  dedicated  to  the  task. 

Dedicating  more  personnel  to  the  Cl  collection  mission  can  enhance  force  protection 
intelligence  collection  capabilities,  but  this  is  more  challenging  than  simply  adding  more 
people  to  AFOSI.  Air  Force  Cl  professionals  must  have  the  maturity  and  interpersonal 
skills  to  interact  with  senior  foreign  and  US  counterparts.  They  can  enhance  their 
effectiveness  by  understanding  foreign  cultures  and  languages.  They  must  also  hold 
clearances  that  grant  them  access  to  compartmentalized  intelligence  information. 

Although  both  Air  Force  Intelligence  and  AFOSI  perform  important  missions,  the 
Air  Force  should  examine  whether  its  current  intelligence  and  Cl  structure  can  meet  the 
demands  posed  by  the  current  international  environment.  Since  1983,  terrorism  attacks 
have  killed  449  DoD  personnel.  In  comparison,  the  US  military  suffered  148  battle 
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deaths  during  the  Persian  Gulf  War.  Although  military  intelligenee  activities 
contributed  to  the  relatively  low  number  of  US  causalities  in  the  Gulf  War,  these  numbers 
graphically  illustrate  the  importance  of  force  protection  intelligence  as  the  Air  Force 
transitions  to  an  expeditionary  force. 

The  number  of  Air  Force  personnel  committed  to  foreign  intelligence  greatly 
exceeds  the  number  dedicated  to  CL  As  of  October  31,  2001,  AFOSI  had  373  officer  and 
701  enlisted  Special  Agents  performing  the  full  range  of  AFOSI  missions.  In 
comparison,  the  Air  Force  had  2,687  officers,  and  10,831  enlisted  personnel  holding  Air 
Force  specialty  codes  (AFSCs)  in  the  field  of  intelligence.  These  numbers  include  3,533 
enlisted  cryptologic  linguists.  The  Air  Force  has  reduced  the  number  of  personnel 
within  both  career  fields  since  1990,  but  these  reductions  have  hit  AFOSI  harder  than  Air 
Force  Intelligence.  The  Air  Force  had  508  officer  and  933  enlisted  AFOSI  agents,  and 
Air  Force  Intelligence  had  3,323  officers  and  12,915  enlisted  personnel  in  1990.  The 
Air  Force  Office  of  Special  Investigation’s  active  duty  agent  force  was  reduced  by  24 
percent  between  1990  and  2001,  while  Air  Force  Intelligence  lost  17  percent  of  its  active 
duty  personnel. 

The  immense  difference  in  the  number  of  personnel  the  Air  Force  dedicates  to 
foreign  intelligence  and  Cl  demands  a  review.  Transferring  four  percent  of  the  active 
duty  personnel  now  dedicated  to  foreign  intelligence  activities  to  Cl  would  increase 
AFOSI’s  active  duty  manpower  by  over  50  percent.  This  transfer  would  greatly  enhance 
the  Air  Force’s  organic  HUMINT  collection  capabilities,  and  improve  the  collection  of 
intelligence  needed  to  counter  Basic,  Level  I,  and  Level  II  threats. 
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One  option  to  fill  these  positions  would  be  to  assign  eompany  grade  offieers  and 
mid-level  NCOs  holding  intelligenee  AFSCs  to  eareer  broadening  assignments  as  AFOSI 
Speeial  Agents.  These  personnel  would  be  required  to  meet  all  eurrent  AFOSI 
reeruitment  standards,  and  would  attend  the  11 -week  Speeial  Investigators  Course  (SIC). 
After  eompleting  the  SIC,  they  would  be  assigned  to  Cl  eolleetion  or  analysis  duties. 
Intelligenee  personnel  with  language  skills  would  be  highly  desired  for  these  positions. 
After  eompleting  a  four  year  eontrolled  tour  with  AFOSI,  these  personnel  would  return  to 
the  intelligenee  career  field.  In  addition,  the  Air  Force  should  assign  selected  AFOSI 
personnel  to  career  broadening  positions  within  Air  Force  Intelligence.  This  program 
would  offer  benefits  to  AFOSI,  Air  Force  Intelligence,  and  the  Air  Force  as  a  whole. 

AFOSI  would  obtain  additional  personnel,  and  be  able  to  capitalize  on  the 
experience  and  language  skills  held  by  Air  Force  Intelligence  professionals.  Air  Force 
Intelligence  would  benefit  when  these  personnel  returned  to  intelligence  duties.  The 
personnel  would  better  understand  intelligence  support  to  force  protection,  and  the 
interaction  between  foreign  intelligence  and  Cl.  Linguist  personnel  would  have  the 
opportunity  to  live  and  work  in  a  foreign  country  where  they  could  use  their  language 
skills  on  a  regular  basis,  and  directly  interact  with  foreign  liaison  contacts.  This  would 
enhance  their  foreign  language  skills  and  cultural  knowledge,  and  make  them  more 
valuable  when  they  returned  to  intelligence  duties.  AFOSI  personnel  selected  to  perform 
an  assignment  with  Air  Force  Intelligence  would  gain  a  better  understanding  of  national 
collection  assets,  improved  knowledge  of  sensitive  compartmented  information  (SCI) 
communication  and  analytical  tools,  and  increased  analytical  skills.  They  could  share 
this  knowledge  with  the  rest  of  AFOSI  when  they  returned  to  the  command.  Finally,  the 
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Air  Force  would  benefit  by  enhaneing  its  foree  proteetion  intelligenee  eolleetion 
capabilities,  and  improving  understanding  and  cooperation  between  its  intelligenee  and 
Cl  professionals. 
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Chapter  4 


The  Importance  of  Analysis  and  Production 


Regardless  of  the  quality  of  raw  information  obtained  by  field  collectors,  it  is  of 
limited  value  if  trained  professionals  do  not  properly  analyze  it  and  disseminate  it  to 
consumers.  Intelligence  analysts  serve  the  vital  role  of  turning  raw  collections  into 
finished  intelligence. 

The  Dangers  Posed  by  Solely  Relying  on  National-Level  Analysis 

The  Intelligence  Community  Counterterrorist  Center  (CTC)  is  the  national-level 
agency  tasked  with  analyzing  terrorism  related  intelligence.  Analysts  from  the  CIA, 
NS  A,  Defense  Intelligence  Agency,  Federal  Bureau  of  Investigation  and  State 
Department  staff  the  CTC.^  Although  the  CTC  performs  a  valuable  service  to  the  United 
States,  it  cannot  respond  to  every  need.  National-level  analysts  lack  detailed  knowledge 
of  Air  Force  installations,  deployments,  exercise  participation,  and  operational  plans 
required  to  provide  tailored  support  to  Air  Force  commanders.  These  analysts  also  lack 
the  ability  to  monitor,  track,  and  directly  communicate  with  in-transit  Air  Force  aircraft 
and  personnel.  Finally,  national-level  analysts  can  not  be  instantly  responsive  to  Air 
Force  Component  Commanders  and  their  planning  staffs.  The  Air  Force  requires  an 
organic  force  protection  intelligence  analytical  capability. 
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Current  Air  Force  Force  Protection  Intelligence  Analysis  Efforts 

Current  Air  Force  doctrine  assigns  force  protection  analysis  responsibilities  to  both 
Air  Force  Intelligence  and  Cl  personnel.  This  division  of  responsibility  has  resulted  in 
confusion  and  duplication  of  effort.  To  improve  the  Air  Force’s  ability  to  analyze  force 
protection  information  and  produce  actionable  intelligence,  the  Air  Force  must  clarify  the 
roles  of  Air  Force  Intelligence  and  AFOSI. 

The  mission  of  the  Air  Force  is  to  engage  in  air  combat.  Early  airpower  advocates 
fought  to  establish  an  independent  Air  Force  by  demonstrating  airpower’s  ability  to  by¬ 
pass  fielded  ground  forces  and  strike  strategic  targets  in  the  enemy’s  rear  area.  Air  Force 
Intelligence  supports  air  combat  operations  by  analyzing  enemy  air  defense  capabilities, 
reviewing  enemy  tactics,  and  identifying  targets.  Air  Force  Intelligence  focuses  its 
analytical  efforts  against  air  threats.  For  example,  only  3  of  the  approximately  140 
people  assigned  to  US  Central  Command  Air  Forces  (USCENTAF)  A-2  are  dedicated  to 
force  protection  analysis.  Although  the  focus  on  air  threats  appears  logical,  it  fails  to 
consider  the  asymmetrical  threat  posed  by  terrorist  or  sabotage  operations  designed  to 
destroy  Air  Eorce  combat  power  on  the  ground.  The  Air  Eorce  will  never  possess  an 
effective  force  protection  analytical  capability  if  it  continues  to  treat  the  analysis  of 
ground  threats  as  an  adjunct  mission  shared  by  two  distinct  organizations. 

Terrorist  Planning  Cycles 

Eorce  protection  analysts  must  take  a  strategic,  long-term  view  to  identifying  force 
protection  threats  and  predicting  terrorist  attacks.  Terrorists  must  collect  intelligence, 
train,  and  conduct  detailed  planning  before  carrying  out  major  attacks.  Performing  these 
tasks  can  take  years,  and  it  is  during  this  period  that  intelligence  and  Cl  officials  have  the 
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best  opportunity  to  detect  and  neutralize  threats.  The  Khobar  Towers  attack  provides  an 
example  of  a  typical  planning  cycle  for  a  major  terrorist  attack.  The  Hizballah  operatives 
believed  to  have  conducted  this  attack  began  intelligence  collection  and  planning 
activities  in  1993.  They  recognized  American  military  personnel  were  billeted  at  Khobar 
Towers  in  the  fall  of  1994,  and  began  regular  surveillance  of  the  facility  in  June  1995. 
Planning  for  the  attack  continued  through  March  1996  when  Saudi  Arabian  border  guards 
arrested  a  Hizballah  member  attempting  to  smuggle  38  kilograms  of  plastic  explosive 
into  the  country.  The  subsequent  investigation  led  to  the  arrest  of  two  additional 
Hizballah  members.  Despite  this  setback,  Hizballah  leaders  were  able  to  recruit 
replacements  for  those  arrested,  and  continued  planning  for  the  attack."^  Although  it  is 
impossible  to  determine  if  an  improved  force  protection  intelligence  capability  would 
have  allowed  US  officials  to  counter  this  attack,  hindsight  shows  that  there  were  at  least 
some  opportunities  to  detect  this  plot. 

Improving  Air  Force  Force  Protection  Analysis  Capabilities 

The  Air  Force  should  clearly  assign  the  responsibility  for  analyzing  Basic,  Level  I, 
and  Level  II  threats  to  AFOSI,  and  give  the  command  the  resources  needed  to  perform 
this  mission.  Air  Force  Intelligence  should  maintain  the  responsibility  for  analysis  of 
Level  III  threats.  This  paper  proposes  the  creation  of  an  Air  Force-level  force  protection 
analysis  cell  that  would  conduct  24-hour  operations.  AFOSI  Special  Agents,  and 
SIGINT,  HUMINT,  and  IMINT  specialists  from  Air  Force  Intelligence  would  staff  this 
cell.  In  addition,  this  cell  would  contain  representatives  from  Security  Forces  (SF), 
explosive  ordinance  disposal  (EOD),  medical,  operations,  and  communications. 
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AFOSI  personnel  would  bring  knowledge  of  Cl  collection  and  investigative 
capabilities.  They  would  also  possess  in-depth  understanding  of  the  structure  and 
capabilities  of  foreign  intelligence  services,  international  and  domestic  terrorist 
organizations,  and  criminal  enterprises.  Air  Force  Intelligence  personnel  would  bring 
knowledge  of  national  level  intelligence  collection  capabilities  and  the  ability  to  access 
this  intelligence.  Security  Forces,  EOD,  and  medical  professionals  would  provide 
knowledge  of  physical  security  measures,  explosive  effects,  and  biological  threats. 
Operations  personnel  would  track  operational  deployments  and  the  status  of  in-transit 
aircraft.  Communication  specialists  would  maintain  computer  and  communication 
systems  needed  to  access  and  process  all-source  intelligence. 

This  analytical  cell  would  produce  daily  Air  Force  level  force  protection  intelligence 
summaries  at  the  SCI  and  SECRET  Collateral  levels  for  distribution  to  senior  Air  Eorce 
leaders  and  Air  Eorce  units  world-wide.  These  products  would  replace  the  separate  force 
protection  analytical  products  currently  produced  by  AEOSI  and  Air  Eorce  Intelligence. 
Effective  analysis  demands  more  than  the  production  of  daily  summaries  of  raw 
intelligence  reporting.  To  meet  this  challenge,  this  cell  would  conduct  detailed,  long¬ 
term  analysis  of  worldwide  terrorism  and  other  force  protection  threats  to  Air  Eorce 
resources.  It  would  serve  as  the  primary  Air  Eorce  interface  with  US  national  analytical 
cells  including,  the  CTC,  the  Defense  Intelligence  Agency  Threat  Warning  Center  and 
the  EBI  counterterrorism  analytical  center. 

The  Air  Eorce  should  create  similar  force  protection  analytical  cells  at  major 
commands  (MAJCOMs)  and  Numbered  Air  Eorces  (NAEs)  that  serve  as  Air  Eorce 
Components  to  the  Geographic  Combatant  Commands.  These  cells  would  be  similar  in 
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make-up  to  the  Air  Force-level  cell,  but  would  focus  exclusively  on  threats  to  Air  Force 
forces  within  their  area  of  responsibility  (AOR).  These  units  would  support  all  Air  Force 
units  within  their  AOR  to  include  permanent  units,  deployed  forces,  exercise  participants, 
and  in-transit  aircraft.  These  cells  would  produce  anti-terrorism  threat  and  vulnerability 
assessments  to  support  Air  Force  installations,  deployment  locations,  and  airfields  used 
by  in-transit  aircraft  throughout  their  AOR.  The  cells  would  produce  these  products  at 
the  SCI  and  collateral  levels  to  provide  the  best  possible  support  to  all  consumers. 

In  addition  to  supporting  Air  Force  units  from  the  MAJCOM  or  NAF,  these  units 
would  maintain  a  deployment  capability  that  would  allow  them  to  provide  on-the-ground 
support  to  major  exercise  and  contingency  deployments.  These  cells  would  have  to 
possess  deployable  SCI  communication  and  computer  systems  and  the  personnel  to  build 
and  maintain  these  links  in  austere  environments. 

As  well  as  producing  daily  summary  products  and  threat  assessments,  the  Air  Force- 
level  force  protection  analysis  cell  and  its  geographic  counterparts  would  provide  direct 
feedback  to  AFOSI  field  collectors.  Analysts  would  be  responsible  for  identifying 
collection  gaps,  writing  collection  emphasis,  determining  the  commander’s  priority  force 
protection  intelligence  requirements,  and  identifying  investigative  leads  and  operational 
opportunities.  To  succeed  in  this  role,  the  cell  must  have  the  authority  to  directly  task 
AFOSI  field  collectors,  and  monitor  on-scene  Cl  investigative  and  collection  support. 
For  this  reason,  these  cells  should  be  under  the  operational  control  of  AFOSI.  The 
national  cell  would  be  under  the  operational  control  of  the  AFOSI  Director  of  Operations. 
The  cells  supporting  Component  Commands  would  be  under  the  operational  control  of 
the  AFOSI  Region  or  Squadron  Commander  tasked  to  support  that  Component. 
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Chapter  5 


Conclusions 

Recent  conflicts  including  Operations  Desert  Storm  and  Allied  Force  have 
demonstrated  the  overwhelming  superiority  and  effectiveness  of  US  airpower.  It  is 
difficult  to  imagine  the  US  facing  an  enemy  in  the  near  future  who  could  effectively 
counter  US  airpower  in  a  force  on  force  engagement.  Despite  the  superiority  of  US 
airpower,  the  US  Air  Force  cannot  fall  into  the  trap  of  believing  that  its  forces  are 
immune  from  threats.  Our  potential  adversaries  have  studied  the  lessons  from  Desert 
Storm  and  Allied  Force  and  have  likely  come  to  the  conclusion  that  one  way  to  counter 
US  airpower  is  to  destroy  it  on  the  ground  before  it  can  launch.  The  fact  that  the  Iraqis  or 
Serbs  failed  to  utilize  unconventional  attacks  to  damage  US  airpower  does  not  in  any  way 
mean  that  future  adversaries  will  make  these  same  mistakes. 

We  must  face  the  fact  that  future  enemies  could  use  asymmetrical  tactics  including 
terrorist  and  sabotage  attacks  against  US  aircraft,  aircrew  lodging,  and  maintenance 
personnel  and  facilities  in  an  effort  to  counter  the  overwhelming  dominance  of  US 
airpower.  A  kill  is  a  kill.  It  doesn’t  matter  if  an  enemy  terrorist  or  special  operator 
destroys  an  aircraft  on  the  ground  or  an  aircraft  is  destroyed  by  an  enemy  surface  to  air 
missile  or  air  superiority  tighter.  The  end  result  is  the  same.  With  the  destruction  of  that 
aircraft,  the  US  has  lost  combat  capability.  The  Air  Force  devotes  considerable  resources 
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to  detecting,  tracking  and  analyzing  threats  to  airborne  aircraft.  It  must  devote  equivalent 
effort  to  protecting  airpower  on  the  ground. 

Terrorism  and  other  force  protection  threats  will  continue  to  endanger  Air  Force 
personnel,  installations,  and  resources  in  the  future.  Given  the  expeditionary  nature  of 
Air  Force  operations  and  the  potential  that  terrorists  will  obtain  access  to  weapons  of 
mass  destruction,  we  can  expect  the  danger  posed  by  these  threats  to  increase.  The  US 
Air  Force  will  not  be  able  to  counter  asymmetrical  threats  unless  it  takes  action  to 
strengthen  its  force  protection  intelligence  doctrine,  clarifies  the  role  of  AF  Intelligence 
and  AFOSI  in  force  protection  efforts,  removes  barriers  that  prevent  full  integration  of 
Air  Force  investigative  resources  in  federal  anti- terrorism  task  forces,  and  dedicates 
additional  resources  to  the  collection  and  analysis  of  intelligence  on  force  protection 
threats. 

The  commissions  chartered  to  examine  previous  terrorist  actions  including  the 
attacks  on  the  Marine  Barracks  in  Lebanon,  Khobar  Towers  in  Saudi  Arabia,  and  the  USS 
Cole  in  Yemen  have  stressed  the  need  to  improve  HUMINT  collection  and  antiterrorism 
analysis  capabilities.  Detailed  studies  of  the  attacks  of  11  September  2001  will  likely 
yield  similar  conclusions.  The  Air  Force  must  learn  the  lessons  taught  by  these  previous 
attacks.  Air  Force  Intelligence  lacks  a  viable  HUMINT  mission  based  on  current 
Department  of  Defense  policies,  and  AFOSI  maintains  the  sole  antiterrorism  HUMINT 
capability  in  the  Air  Force.  The  Air  Force  must  take  advantage  of  this  small,  yet  existing 
HUMINT  capability  in  its  efforts  to  counter  terrorist  and  sabotage  threats  to  its  forces. 
To  improve  it’s  HUMINT  capabilities,  the  Air  Force  should  assign  additional  resources 
to  AFOSI.  Current  Air  Force  doctrine  assigns  responsibility  for  analyzing  force 
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protection  threats  to  Air  Force  Intelligence  and  AFOSI.  This  duplication  has  caused 
confusion  and  resulted  in  wasted  effort.  The  Air  Force  should  assign  AFOSI  the 
responsibility  for  analyzing  force  protection  threats,  and  then  adequately  staff  the  agency 
so  they  can  perform  this  mission. 

We  will  never  fully  eliminate  the  threat  posed  to  the  Air  Force  by  terrorists  or  other 
criminals.  Our  duties  and  responsibilities  require  us  to  put  our  people  in  harm’s  way,  and 
we  cannot  accomplish  the  mission  without  taking  risks.  The  collection  and  analysis  of 
force  protection  intelligence  identifies  threats  and  better  allows  Air  Force  commanders  to 
manage  risks.  In  doing  so  it  helps  us  protect  the  most  important  resource  in  the  Air  Force 
inventory:  Our  people. 
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Glossary 


all-source  intelligence:  1.  Intelligence  products  and/or  organizations  and  activities  that 
incorporate  all  sources  of  information,  most  frequently  including  human  resources 
intelligence,  imagery  intelligence,  measurement  and  signature  intelligence,  signals 
intelligence,  and  open-source  data  in  the  production  of  finished  intelligence.  2.  In 
intelligence  collection,  a  phrase  that  indicates  that  in  the  satisfaction  of  intelligence 
requirements,  all  collection,  processing,  exploitation,  and  reporting  systems  and 
resources  are  identified  for  possible  use  and  those  most  capable  are  tasked.  (Joint 
Pub  1-02,  12  April  2001) 

basic  threats:  Criminal  activity,  protests,  riots,  natural  disasters,  environmental,  health, 
and  disease  threats,  and  attacks  against  information  resources  are  basic  threats  that 
occur  during  peace  and  war.  (AFDD  2-4.1,  29  October  1999) 
casual  sources:  A  casual  source  is  one  who,  by  social  or  professional  position,  has 
access  to  information  of  Cl  interest,  usually  on  a  continuing  basis.  Casual  sources 
usually  can  be  relied  on  to  provide  information  which  is  routinely  available  to  them. 
They  are  under  no  obligation  to  provide  information.  Casual  sources  include  private 
citizens,  such  as  retired  officials  or  other  prominent  residents  of  an  area.  Members 
of  private  organizations  also  may  furnish  information  of  value.  (US  Army  Field 
Manual  34-60,  3  October  1995) 

counterintelligence.  Information  gathered  and  activities  conducted  to  protect  against 
espionage,  other  intelligence  activities,  sabotage,  or  assassinations  conducted  for  or 
on  behalf  of  foreign  powers,  organizations,  or  persons,  or  international  terrorist 
activities,  but  not  including  personnel,  physical,  document,  or  communications 
security  programs.  (DoD  Directive  5240.1,  25  April  1988) 
counterintelligence  collections:  The  systematic  acquisition  of  information  (through 
investigations,  operations,  or  liaison)  concerning  espionage,  sabotage,  terrorism, 
other  intelligence  activities  or  assassinations  conducted  by  or  on  behalf  of  foreign 
governments  or  elements  thereof,  foreign  organizations,  or  foreign  persons  that  are 
directed  against  or  threaten  Department  of  Defense  interests.  (Joint  Pub  1-02,  12 
April  2001) 

force  protection.  Actions  taken  to  prevent  or  mitigate  hostile  actions  against 
Department  of  Defense  personnel  (to  include  family  members),  resources,  facilities, 
and  critical  information.  These  actions  conserve  the  force’s  fighting  potential  so  it 
can  be  applied  at  the  decisive  time  and  place  and  incorporates  the  coordinated  and 
synchronized  offensive  and  defensive  measures  to  enable  the  effective  employment 
of  the  joint  force  while  degrading  opportunities  for  the  enemy.  Force  protection  does 
not  include  actions  to  defeat  the  enemy  or  protect  against  accidents,  weather  or 
disease.  (Joint  Publication  3-0,  10  September  2001) 
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foreign  intelligence.  Information  relating  to  the  eapabilities,  intentions,  and  aetivities  of 
foreign  powers,  organizations,  or  persons,  but  not  ineluding  eounterintelligenee 
except  for  information  on  international  terrorist  activities.  (DoD  Directive  5240.1,  25 
April  1988) 

human  resources  intelligence:  The  intelligence  derived  from  the  intelligence  collection 
discipline  that  uses  human  beings  as  both  sources  and  collectors,  and  where  the 
human  being  is  the  primary  collection  instrument.  Also  called  HUMINT.  (Joint  Pub 
1-02,  12  April  2001) 

imagery  intelligence:  Intelligence  derived  from  the  exploitation  of  collection  by  visual 
photography,  infrared  sensors,  lasers,  electro-optics,  and  radar  sensors,  such  as 
synthetic  aperture  radar  wherein  images  of  objects  are  reproduced  optically  or 
electronically  on  film,  electronic  display  devices,  or  other  media.  Also  call  IMINT. 
(Joint  Pub  1-02,  12  April  2001) 

intelligence:  1.  The  product  resulting  from  the  collection,  processing,  integration, 
analysis,  evaluation,  and  interpretation  of  available  information  concerning  foreign 
countries  or  areas.  2.  Information  and  knowledge  about  an  adversary  obtained 
through  observation,  investigation,  analysis,  or  understanding.  (Joint  Pub  1-02,  12 
April  2001) 

intelligence  activities.  The  collection,  production,  and  dissemination  of  foreign 
intelligence  and  counterintelligence  by  DoD  intelligence  components  authorized 
under  Executive  Order  12333,  "United  States  Intelligence  Activities,"  December  4, 
1981.  (DoD  Directive  5240.1,  25  April  1988) 
level  I  threats:  Level  I  threats  are  characterized  as  small-scale  operations  conducted  by 
agents,  saboteurs,  sympathizers,  partisans,  extremists,  and  agent-supervised  or 
independently  initiated  terrorist  activities.  Level  I  threats  may  be  unorganized  or 
well  orchestrated  and  may  take  the  form  of  espionage,  demonstrations,  riots,  random 
sniper  incidents,  information  warfare,  physical  assaults,  kidnappings,  aircraft 
hijackings,  or  bombings.  (ALDD  2-4.1,  29  October  1999) 
level  II  threats:  Level  II  threats  include  long-range  reconnaissance,  intelligence 
gathering,  information  warfare,  and  the  sabotage  of  air  or  ground  operations 
conducted  by  special-purpose,  guerrilla,  and  unconventional  forces  or  small  tactical 
units.  (ALDD  2-4.1,  29  October  1999) 

level  III  threats:  Level  III  threats  are  major  attacks  by  large  tactical  forces  who  may  use 
airborne,  heliborne,  amphibious,  and  infiltration  operations.  Attacks  may  also  come 
from  aircraft  and  theater  missiles/artillery  armed  with  conventional  and  NBC 
weapons.  (ALDD  2-4.1,  29  October  1999) 

official  sources:  Official  sources  are  liaison  contacts.  Cl  personnel  conduct  liaison  with 
foreign  and  domestic  Cl  intelligence,  security,  and  law  enforcement  agencies  to 
exchange  information  and  obtain  assistance.  Cl  personnel  are  interested  in 
investigative,  operational,  and  threat  information.  (US  Army  Lield  Manual  34-60,  3 
October  1995) 

open-source  intelligence:  Information  of  potential  intelligence  value  that  is  available  to 
the  general  public.  Also  called  OSINT.  (Joint  Pub  1-02,  12  April  2001) 
recruited  sources:  Recruited  sources  include  those  who  support  counterintelligence 
force  protection  source  operation  (CLSO).  CLSO  are,  by  design,  human  source 
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networks  dispersed  throughout  the  area,  who  ean  provide  timely  and  pertinent  foree 
proteetion  information.  (US  Army  Field  Manual  34-60,  3  Oetober  1995) 

signals  intelligence:  1 .  A  category  of  intelligence  comprising  either  individually  or  in 
combination  all  communications  intelligence,  electronic  intelligence,  and  foreign 
instrumentation  signals  intelligence,  however  transmitted.  2.  Intelligence  derived 
from  communication,  electronic,  and  foreign  instrumentation  signals.  Also  called 
SIGINT.  (Joint  Pub  1-02,  12  April  2001) 

source:  1.  A  person,  thing,  or  activity  from  which  information  is  obtained.  2.  In 
clandestine  activities,  a  person  (agent),  normally  a  foreign  national,  in  the  employ  of 
an  intelligence  activity  for  intelligence  purposes.  3.  In  interrogation  activities,  any 
person  who  furnishes  information,  either  with  or  without  the  knowledge  that  the 
information  is  being  used  for  intelligence  purposes.  In  this  context,  a  controlled 
source  is  in  the  employment  or  under  the  control  of  the  intelligence  activity  and 
knows  that  the  information  is  to  be  used  for  intelligence  purposes.  An  uncontrolled 
source  is  a  voluntary  contributor  of  information  and  may  or  may  not  know  that  the 
information  is  to  be  used  for  intelligence  purposes.  (Joint  Pub  1-02,  12  April  2001) 
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